<?php
namespace ActiveTwist\SEO\Features;

if (!defined('ABSPATH')) {
    exit;
}

class Monitor404
{
    const OPTION_KEY_LOG = 'at_seo_404_log';
    const MAX_LOG_SIZE = 200;

    public function init()
    {
        add_action('template_redirect', [$this, 'capture_404']);
        add_action('admin_post_at_seo_clear_404_log', [$this, 'handle_clear_log']);
    }

    public function capture_404()
    {
        if (!is_404()) {
            return;
        }

        // Ignore admin, favicon, robots, etc if caught here (though robots usually handled before template_redirect)
        if (is_admin()) {
            return;
        }

        // Get safe data
        // PRD 2.4 says: requested path, referrer, time. No IP, no query string storage?
        // "Do not store full query strings (store path only)"
        $request_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
        $path = (string) wp_parse_url($request_uri, PHP_URL_PATH);

        // Basic noise filtering
        if (preg_match('/\.(jpg|png|gif|css|js|map|ico)$/', $path)) {
            return;
        }

        $referrer_raw = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
        $ua_raw = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';

        $log_entry = [
            'time' => time(),
            'path' => substr($path, 0, 255), // Limit length
            'referrer' => !empty($referrer_raw) ? esc_url_raw(substr($referrer_raw, 0, 255)) : '',
            'ua' => !empty($ua_raw) ? sanitize_text_field(substr($ua_raw, 0, 100)) : ''
        ];

        $this->append_log($log_entry);
    }

    private function append_log($entry)
    {
        // We use get_option / update_option. 
        // Note: For high traffic sites this faces race conditions. 
        // PRD 2.4 "Minimal", "No background processing". 
        // Acceptance criteria says "404 monitor records and displays recent 404s".
        // Options API is atomic enough for low volume, but risky for high volume.
        // Given constraints (no DB tables), we accept this limitation.

        $log = get_option(self::OPTION_KEY_LOG, []);
        if (!is_array($log)) {
            $log = [];
        }

        // Prepend new entry
        array_unshift($log, $entry);

        // Trim
        if (count($log) > self::MAX_LOG_SIZE) {
            $log = array_slice($log, 0, self::MAX_LOG_SIZE);
        }

        update_option(self::OPTION_KEY_LOG, $log, false); // autoload=false
    }

    public static function get_log()
    {
        $log = get_option(self::OPTION_KEY_LOG, []);
        return is_array($log) ? $log : [];
    }

    public function handle_clear_log()
    {
        if (!current_user_can('manage_options')) {
            wp_die('Unauthorized');
        }

        check_admin_referer('at_seo_clear_404', 'at_seo_min_nonce');

        update_option(self::OPTION_KEY_LOG, []);

        wp_safe_redirect(add_query_arg(['page' => 'active-twist-seo-status', 'tab' => 'errors', 'cleared' => '1'], admin_url('admin.php')));
        exit;
    }
}